Half-life, air gaps, and rumor-driven exploits

00:00:04 OpenAI is ending its partnership with Cursor following the company's acquisition by SpaceX, and direct model access will stop on November 12. The tweet hit 7,099 likes and nearly 1.8 million views. That kind of attention on a partnership split isn't unusual in this space, but the timing is what stands out.

00:00:25 OpenAI published its own blog post about the decision, which earned over 600 points on Hacker News. They said they understand developers relying on Cursor's models will be affected — and that they care about it. On the surface, it looks like a standard partnership split after an acquisition — the normal pattern in tech.

00:00:47 But it lands alongside a few other signals stacking in the same direction: model providers are pulling back on developer-facing relationships, enterprise teams are watching their infrastructure investments age, and security researchers are noticing that attackers no longer wait for embargoes.

00:01:07 The exact mechanics of the deal aren't public yet, but OpenAI made an active call instead of letting it drift. That matters because both sides were feeding into each other's work: Cursor users shaped their expectations about model capabilities, and those improvements shifted what developers expected back in the tool.

00:01:29 I'm not sure how this reshapes the developer-tool ecosystem just yet. Whoever fills that space next will decide whether Cursor users keep their model access through a different channel, or if they have to start over with something new.

00:01:46 Ben Kus, Box's CTO, stood on this very stage at an AI engineering conference last year and recommended a graph-based approach to building agents. Someone told him afterward that it was exactly the answer they needed. Kus opens his talk today by retracting that advice — not because it was wrong when he gave it, noting that "nothing about the advice was wrong," but because a better way arrived, followed by yet another.

00:02:16 He runs that same exercise across models, agent design, and retrieval systems. Every recommendation from last year has been updated by something newer. He says the rate of change is dramatically higher than in previous technology waves. The internet stayed built on HTTP for years.

00:02:36 Mobile stayed iOS and Android. But with generative AI as the foundation, everything underneath keeps improving. The timeline he traces starts with single-shot large language model response calls, moves to chain-of-thought reasoning, then graph-based agent systems, and now sits at autonomous planning across sub-agents.

00:02:59 Each was "the key approach" at its moment — now they're getting superseded. At Box's scale — over an exabyte of data, tens of millions of users, hundreds of billions of content objects, and roughly a trillion tokens a year (probably heading toward ten) — this isn't just academic.

00:03:19 Every architecture decision carries massive lock-in costs. What Kus is describing is something engineers feel but rarely talk about: your best recommendation today becomes your worst path forward in six months. You can't build on top of that uncertainty without accepting heavy rework.

00:03:40 The angle here isn't the architecture shift itself — it's the half-life. Infrastructure used to have decades-long lifespans. HTTP still underpins most of the web twenty-five years later. Now a graph-based agent pattern goes from cutting-edge advice to outdated recommendation in about twelve months.

00:04:01 The engineers who actually built these systems are noticing the speed, and they're uncomfortable enough to publicly retract their own prior positions.

00:04:12 Anil Madhavapeddy released a security fix for OCaml's cohttp last week — a path traversal issue. The patch itself was straightforward. Under normal circumstances, you'd fix it privately, inform affected users, and issue a public advisory. Probes hit his live webserver logs with the exact bug pattern just minutes after opening the PR.

00:04:36 He pointed his own Claude at the affected code to see what else was lurking — DeepSeek V4 Pro obliged and turned up several related issues on its own. His agent trivially built an exploit to probe a local server in under a minute. If he could do it in sixty seconds, ten minutes for the first automated probe to hit his public repo seemed almost generous.

00:05:02 The paper by Fang et al. that he cites found that when given a CVE description, a GPT-4 agent exploited 87 percent of a fifteen-vulnerability benchmark. Without the description, only seven percent. Anil's point is that you don't need the full specification anymore — just knowing the bug class exists means an agent can generate an exploit from it.

00:05:27 Here's the number: the mean time to exploit crossed zero around 2024. Exploitation now precedes the patch. That metric hovered around sixty-three days back in 2018 and 2019. Marimo's CVE went from advisory to first exploitation attempt in nine hours without a public proof of concept, and Langflow's took twenty.

00:05:49 The paper coined the term "bugonomics" and argues the bottleneck shifted to defender remediation throughput. Large language models are generating exploits at scale, while maintainer validation, triage, and release rates stay flat. The asymmetry is structural: automated search costs almost nothing, but a security patch that doesn't cause regressions still takes human engineering time.

00:06:17 Anil notes that Western frontier models have security guards preventing OSS maintainers from using them for their own vulnerability research, even as attackers leverage those same models. Project Glasswing has expanded to 150 organizations across fifteen countries — including critical infrastructure operators — but small project maintainers still don't have access.

00:06:43 The timeline tells the story here. Security embargoes worked because there was a window between disclosure and exploitation — enough time for a patch to ship before anyone could use the bug. That window is gone. The rumor of a bug is all new agentic exploit systems need.

00:07:02 A single person searching for an issue class, one odd commit in an orphan branch, or one context leak is enough to alert someone else's agent. What comes next depends on whether major model providers relax their security guards for verified OSS maintainers doing vulnerability research, or if that gap widens further.

00:07:25 Rachna Srivastava's team at the California Department of Financial Protection and Innovation protects financial identity data for 39 million residents. Their job is to identify fraud, examine it, collect evidence, and hand it over to the courts. In court, the defense attorney has one job: attack the system your team built.

00:07:48 So every piece of AI they build has to be defendable — explainable, reproducible, and auditable at every step. Everything they produce appears in court. Their first decision was extreme by design: build it offline, using physical air-gapping instead of software firewalls.

00:08:06 The reasoning is blunt — any configuration can be misconfigured, and a misconfigured secure system is an exploited one. Cloud providers own the disks even with private endpoints. FedRAMP and SOC 2 compliance are just paper. When you see the cost of deception collapse and the speed of deception explode, software boundaries stop looking reliable.

00:08:30 Their first attempt — download an open-source model, create an isolated environment, spin up some GPUs, add guardrails — collapsed in two hours. They were treating the machine learning model as a magic box instead of a data pipeline. So they broke it into three tools for three problems: Kafka for ingestion (handling traffic spikes and preserving event ordering), Spark for processing, and the large language model strictly for reasoning.

00:09:01 The replayability of Kafka events is their court evidence — they can roll the checkpoint back to the moment a decision was made and replay the exact sequence. The insight that sticks with me isn't the air gap itself — it's the division of labor between deterministic infrastructure and probabilistic models.

00:09:22 Kafka handles ordering, reproducibility, and volume. Spark handles transformation. The model layer handles reasoning over structured data. Each piece does one thing well, and the chain between them stays auditable. This works because government teams face a different constraint set than startups.

00:09:42 When your output goes to court, every assumption gets attacked. There's no "move fast" with that requirement. You build what you can prove, not what moves fastest. The parallel for the broader ecosystem is worth noting: how many private teams will face the same trajectory as regulatory scrutiny increases?

00:10:03 Air-gapping is expensive and operationally painful, but it's the only approach that pulls the cloud provider out of the threat model entirely.

00:10:13 A post on the pwning.systems blog about turning large language model memory into program analysis caught my attention. The author runs vulnerability research agents and keeps hitting the same wall: once an investigation runs for a few hours, the model loses track of what was actually established.

00:10:33 It suggests approaches they already ruled out. It forgets that an assumption turned out to be false and confidently continues reasoning from an observation that no longer holds. Telling it something is wrong doesn't necessarily mean it stops believing everything that depended on it.

00:10:52 The insight comes from taking a different angle: what you need isn't a better memory system, but a deterministic layer for maintaining what you currently know. The author calls this Lemmalog and implements it as a Datalog engine. Here's the distinction that makes it work.

00:11:10 A normal memory system stores old observations somewhere, embeds them, and retrieves the most relevant pieces whenever the model needs them again. That approach works until your investigation stretches out, the prompt gets too long, and retrieving selectively starts dropping context.

00:11:28 Datalog stores facts and rules separately from the model. The large language model handles the fuzzy part — interpreting debugger output, source code, and natural language observations. Lemmalog handles the deterministic part: facts, rules, and derived conclusions.

00:11:46 If an observation changes, only the affected conclusions get invalidated automatically. You can also ask why something is true and trace the provenance chain. During vulnerability research, a conclusion like "candidate three is exploitable" might rest on multiple independent paths — one attacker-controlled pointer and one pointer reaching its target.

00:12:09 If one path turns out wrong, the other still holds. The database tracks that distinction. A model reading from raw memory would have to reconstruct it. Tested against LongMemEval and LoCoMo benchmarks, this approach treats persistent knowledge in agents as a database engineering problem rather than a prompting one.

00:12:30 It's the same separation of concerns that static analysis tools have used for decades: facts flow through rules to produce derived conclusions, with incremental updates when inputs change. The point here is straightforward. The author stopped trying to make the model remember things better and built a layer that maintains what was learned.

00:12:52 It's the kind of solution that doesn't sound like an innovation until it's actually in use — because it just sounds like engineering. Infrastructure ages faster now, and different teams are just learning where to draw their lines before the half-life expires. — Seln.